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Abstract: Braids groups provide an alternative to number theoretic public 
cryptography and can be implemented quite efficiently. The paper proposes five 
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Verifier, Designated Verifier Proxy Signature And Bi-Designated Verifier Proxy 
Signature scheme based on braid groups. We also discuss the security aspects of 
each of the proposed schemes. 

Keywords: Braid groups, designated verifier, proxy signature, conjugacy 
search problem, digital signature. 

1. Introduction 

Braid groups have recently attracted the attention of many cryptographers. These 
highly non-commutative groups are useful to construct cryptosystems They 
provide numerous mathematical hard problems such as the conjugacy search 
problem, braid decomposition problem and root problem. Moreover, the group 
operation and generation of the parameters can be implemented quite efficiently. 
Braid groups were introduced in 1947 by Artin [2] and were first used to construct 
a Diffie-Hellmann type key agreement protocol and a public key encryption 
scheme by Ko et al [9]. Many cryptographic protocols based on braid groups have 
since been proposed by Anshel et al [1], Cha et al [3], Ko et al [11], Kim et al [8], 
Thomas et al [21], Girraj [22] etc. 

Proxy signatures were first proposed by Mambo et al [18] in 1996. In the proxy 
signatures an original signer can designate a person as his/her proxy signer and 
delegate the power to sign the digital documents on his behalf Depending upon 
the types of delegation, the proxy signature may be classified as full delegation, 
partial delegation or delegation by warrant. If the original signer gives his private 
key to the proxy signer, the proxy signer gets the same signing capability as the 
original signer. Such delegation is called full delegation. For most of the real 
world settings, full delegation is impractical and insecure. If the original signer 
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generates a proxy secret key for the proxy signer, which the proxy signer uses to 
sign message on behalf of the original signer, but is unable to derive the original 
signer's secret key, the delegation is called partial. However, if the original signer 
gives the proxy signer a warrant composed of a message part, time of validation of 
proxy signature and public key part, the delegation is called by warrant. 
Combining partial delegation and delegation by warrant one may get partial 
delegation with warrant. Based on these concepts, several proxy signature 
schemes [4, 6, 7, 12, 17, 18, 20, 23] have been proposed 

Jakobsson et al [5] proposed the designated verifier signature (DVS) scheme in 
1996. It is a special type of signatures that provides message authentication 
without non-repudiation. In such signature schemes only the designated verifier 
can check the validity of the signatures and he cannot convince anyone else of this 
fact, as he himself is able to produce the indistinguishable signatures. Saeednia 
[19] in 2003 added the concept of strongness in DVS to make them strong 
designated verifier signatures (SDVS), such that the designated verifier can only 
verify the signatures by using his secret key during verification phase. There exist 
several DVS scheme in literature [10, 15, 16, 24]. The concept of proxy signatures 
is added to DVS to generateO designated verifier proxy signature schemes 
(DVPS). Lai et al [13] proposed some DVPS signature schemes in ID based 
cryptography. Lai et al [14] also proposed bi-designated verifier proxy signature 
schemes in which the proxy signature can only be verified by the two verifiers 
designated by the original signer. 

There are several proxy schemes with partial delegation by warrant which are 
based on number theoretic groups however; there exists no such scheme on braid 
groups. In this paper, we first propose 'Proxy Signature Scheme With Partial 
Delegation By Warrant' on braid groups, 'A Designated Verifier Signature' 
(DVS) scheme and 'Bi-Designated Verifier Signature' scheme (Bi-DVS) and then 
combine this proxy signature scheme to the DVS and Bi-DVS to form 'Designated 
Verifier Proxy Signature' (DVPS) scheme and 'Bi-Designated Verifier Proxy 
Signature' (Bi-DVPS) scheme. In our proxy signature schemes, a warrant 
containing the identities of the original signer, the proxy signer and period of 
delegation is attached to the signatures, such signatures are valid for a certain 
period of time and the verifier can check the authenticity of the proxy signatures 
by checking the identity of the proxy signer in the warrant. The security of our 
schemes is based on the conjugacy search problem of braid groups. 

The rest of the paper is organized as follows: in section 2, we state some 
preliminaries, in section 3 we present our proxy signature scheme, in section 4 we 
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propose designated verifier signature scheme and in section 5 we present bi- 
designated verifier signature scheme. In section 6 we present designated verifier 
proxy signature (DVPS) scheme and in section 7 we propose bi-designated verifier 
proxy signature (Bi-DVPS) scheme. Finally, the section 8 concludes the paper. 

2. Preliminaries 

This section discusses the basic definitions of braid groups and some hard 
problems on these groups. 

For n >2, the group B„ of n-braid is the group generated by ct; Ci... cr„.^ with the 
conditions 

(i) <7j<7j -(7j(7j,where\ i-j | > 2 

(ii) (Tj(Tj^j(Tj =(Tj+j(Ti(Ti+j 

Each element of the group B„ is called an n - braid and the integer n is called the 
braid index. An n-braid where 'n ' is an integer is a set of disjoint n-strands all of 
which are attached to two horizontal bars at the top and at the bottom in such a 
way that each strands always heads downward as one follows the path along the 
strand from the top to the bottom. In a set of braids if one braid can be deformed to 
the other continuously then the two braids are said to equivalent The 
multiplication of two braids 'a' and 'b' can be obtained by positioning 'a' on the 
top of 'b'. The identity of group Bn is 'e' which consists of 'n' straight vertical 
strands and the reflection of a with respect to a horizontal line is the inverse of 'a'. 
So by switching the over-strand and under-strand o'^can be obtained from o. 
We now describe some mathematically hard problems in braid groups. Two 
elements x and y are conjugate i.e. x ~ y if there is an element 'a' such that y = 
axa' . For m < n, can be considered as a subgroup of B„ generated by o-y o-^--- 
On-i. In each of the schemes Hi: {0, l}*—>Bi + r and/Zi.- Bi + r —> {0, 1}* are the one 
way hash functions. 

• Conjugacy Decision Problem (CDP) 

Given (x, y) e 5„ xB,, Determine whether x and j are conjugate. 

• Conjugacy Search Problem (CSP) 

Given (x, y) e B„ xB„ which are conjugates find b e B„ such that = bxb'^ 

• Generalized Conjugacy Search Problem (GCSP) 

Given (x, y) e B„ xB„ such thatj = axd^ for some aeB„ ; m < n. find b gB„ 
such that J = bxb'^ 
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• Conjugacy Decomposition Problem (CDP) 

Given (x, y) e B„ xB„ such thatj = axa'^ for some a gB^ m < n. Find bj, b2 
sB„ such that jF = bixb2. 
The public key system on braid groups is based on the generalized conjugacy 
search problem. We consider two subgroups LBi and RB^ of 5/+ ^ for some 
appropriate pair of integers (I, r). LBi (resp. RB^ is the subgroup of 5/+ ^ consisting 
of braids made by braiding left / (resp. right r)-strands among (I + r) strands. LBi 
is generated hy 0102... oi.i and RBr is generated hy ai+i,....ai + r-i For any asLBi 
and b&RBr, ab = ba. 

3. Proposed Proxy Signature Scheme with Delegation by Warrant 

In this section we propose our proxy signature scheme with delegation by warrant. 
Let 'w' be the message to be signed, m^ is the warrant on message 'm' consisting 
of the identities of the original signer Alice, the proxy signer Bob and the period of 
delegation, 

• Key Generation: Each user 'm' chooses a braids x„ Bi+r s.t x„ LBi and 

chooses ( x'^^ —a^^Xj^a'^ Uu) RB^ such that a„ is the secret key and (x'^, x u) 
is the public key of the user. 

• Proxy Key Generation: Original signer chooses a message 'm', a warrant 
'm^' a braid Zg^LBi and computes?^ =a^z^a~^ and sends (niw, Zg, to) to the 
proxy signer Bob. Bob checks tox'^-- z^Xq. If this holds then computes the 

proxy key PK = Upto a'J 

• Proxy Signature Generation: The proxy signer Bob chooses a braid b^LB/ 

and computes h = Hj (H2(tox'J®'i^w), 7 ^ bhb'\ S = bxpb'\ = ba~J (PKJUpb' 
' . Sends (y, S, 0, to, Mw) to the verifier Cindy. 

• Proxy Signature Verification: Verifier on receiving (y, d, 6, to, m^) checks the 
warrant 'mj computes h = Hj(H2(tox'J// and accepts the signature if and 
only if yO--hto, yd--hxp holds. 

• Correctness: The following equation gives the correctness of the verification 
equations: 
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> yO = (bhb-^) (ba~p (PK)apb-^) 

= bh (a-' (PK)ap)b-' 

= b(h to)b-^ 
i.e. yO-hto 

> yS= (bhb-^) (bxpb-^) 

= b(h Xp)b'^ 
i.e. yS^hXp 

• Security Analysis: Regarding security analysis of the scheme we have the 
following: 

> Secrecy of the proxy key: The signature 'o' will not reveal the proxy key 
PK = aptoBp^ 

Explanation: According to braid groups, even if the pair (xj,, x p) and 
(x^, X o) are known to user he cannot obtain ap and ao because for given 

x'p =apXpap' (respx'^ =a^x^a^' ) finding a p and a o is a conjugacy search 

problem. The proxy key also involves a secret braid ZogLB/ chosen by the 
original signer. So. Even if one knows the secret keys of the original signer 
and the proxy signer he will not be able to construct the valid proxy 
signatures. So, signature 'o' will not reveal the proxy key PK. 

> Signer protection: Only the legal signer can generate the valid proxy 
signatures. 

Explanation: The legal proxy signer can only generate a valid proxy key as 
the construction of proxy key PK = aptoEp' involves the secret key 'a p' of the 

proxy signer. Moreover, the original signer restricts others user's from 
forgeing the signatures attaches a warrant 'm ^' (containing the identity of 
proxy signer) to the signatures. 

> Proxy protection: No one can generate the proxy signatures except for the 
real proxy signer. 

Explanation: As shown in 4.2 only the legal signer can create the valid 
proxy key. So, no one including the original signer can construct the valid 
proxy key and the valid proxy signatures. 
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> Original Signer Protection: The signer indeed authorizes the proxy signer. 
Explanation: The original signer authorizes the proxy signer to generate the 
proxy signatures for the 'm' through a warrant 'm that contains the identity 
of the proxy signer, message to signed and the period of delegation. 

4. Proposed Single Designated Verifier Signature Scheme 

This section proposes the single designated verifier signature scheme. The security 
of the scheme is based on the conjugacy problem and the base problem in braid 
groups. Here we have assumed Alice as the original signer, Bob as the proxy 
signer and Cindy as the designated verifier chosen by the Alice. Let 'm' be the 
message to be signed. 

• Key Generation: Same as section 3. 

• Signature Generation: The signer Alice chooses a message 'm' and a braid 

b^LBi and computes a = bxjf^ P = bx'^b'\ h = Hi(H2(P)® m), 5 = agha'^ 

Sends a = (m, a, S) to the designated verifier Cindy as the signature on message 
'm'. 

• Signature Verification: Cindy on receiving the signatures o computes 
P = acaa~\ h = Hj(H2(fi)®m) and accepts the signature if and only if 
Sx^~hXo holds. 

• Correctness: The following equations give the correctness of the verification: 

> d = Ugh 
i.e. d~h 

> Sx[ =(aoha'~J)( a^x^a'J ) 

i.e. hxg 

• Applications 

Strong Designated Verifier Signature schemes proposed here have several 
practical applications in the situations where the signer wishes to convince only 
one person about the validity of the signatures. One application of SDVS schemes 
is where tenderers use SDVS to digitally sign their quotations. Another application 



6 



of SDVS is in software licensing. Software companies' use digitally signed keys 
as there software license so that these keys can only be used by the person who 
buys the product. Use of SDVS to produce digitally signed keys/licenses protects 
illegal distribution of the software. 

• Security Analysis: 

> Strongness: Only the designated verifier can verify the signatures. 

Explanation: Only the designated verifier can verify the signatures, non- 
designated verifiers cannot verify the signatures. Firstly, the designated verifier 
have secret key a^, computering P = Ucaa]^ , h = Hi(H2(P)®m). Secondly, if 

non-designated verifier wants to verify the signatures they must compute P and 
h. But they do not hold the secret key ac of the designated verifier. However, 
the security of finding p is based on Base problem 1 (which is mathematically 
difficult because of the previous cryptographic assumptions). 
Base problem 1: 

Instance: The triple (Xc, a, '^'J of elements in Bi + ^ such that a = bxcb'^ and 
X ^ = a ^ X ^ a ' for some hidden ac e RBn and b g LBi. 
Objective: Find a^ (= ac bxc a~^b'^) 

Thus, non-designated verifiers cannot compute P, nor carry out the verification. 

> Unforgeability: Non-designated verifiers cannot forge the signatures. 

Explanation: Suppose an opponent captures the signatures (m, a, S) and he try 

to operate the forgery from the condition of the verification i.e. he wants to 
determine h (= Hi(H2(p)®m)) such that the condition of verification (dx[- 

hxo, S - h) are satisfied. But for obtaining '/z' he must compute P (= acUa'^ ). 

But P (= ttcaa'^) uses the secret key of the verifier. Hence, he cannot forge the 

signatures from the condition of verification. 

5. Proposed Bi-Designated Verifier Signature Scheme 

This section proposes the bi-designated verifier signature scheme. We have added 
the one more designated verifier (Trevor) in the scheme stated in section 4 to 
propose our bi-designated signature scheme and the security of the scheme is 
based on the base problem in braid groups. Moreover, the scheme is constructed in 
such a manner that the two verifiers can verify the signatures individually even if 
they do not know anything about each other. 

• Key Generation: Same as section 3. 
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• Signature Generation: The signer Alice chooses a message 'm' and a braid 

b^LBi and computes «; = bxcb'\ Pi = bx[b'^, a2 = bxjb'^, P2 = bx'^b'^, h = 

Hi(H2(PiP2)®m), S = aoha~\ Sends a] = (m, a], P2, ^) to the designated 

verifier Cindy and 02 = (m, a2, f^i, S) as the signature on message 'm' to the 
designated verifier Trevor. 

• Signature Verification: Cindy on receiving the signatures ui computes Pi = 
Ucaja'^ , h = Hi(H2(pip2)®m), and accepts the signature if and only if (5 ~ /j 
and (5 ~ hxo holds. 

Similarly, Trevor on receiving 02 computes P2 = aja2Cij\ h = 
Hj(H2(PiP2)®m), and accepts the signature if and only if ^ ~ /z and hXo 
holds. 

• Correctness: The following equations give the correctness of the verification: 

> 5 = ttgh i.e. S^h 

> <5x^ = (aoha~^)( a^x^a^^ ) 

= a^(hxja~j 
i.e. Sx'g^ hxg 

• Applications: 

Consider the following situation: Alice is starting a new project and for certain 
reasons he needs to discuss the same project with both Bob and Cindy for their 
help and suggestions. But Alice does not want his project details to get leaked 
while discussion with Bob and Cindy. Moreover, he does not want Bob and Cindy 
to convince any other person that this project is being started by Alice. In this 
situation Strong Bi-Designated Verifier Signature Scheme as proposed in chapter 
4, may be considered very useful. As for the discussions with Bob and Cindy, 
Alice will digitally sign his project proposal using SBiDVS. 

• Security Analysis: 

> Strongness: Only the designated verifiers can verify the signatures. 
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Explanation: Only the designated verifiers can verify the signatures, non- 
designated verifiers cannot verify the signatures. Firstly, the designated 
verifiers have secret key Uc and Ut, computering Pi = acaia~\ P2 = aja2a:^^ 

and h = H] (112(^1^2) ® ^) ■ Secondly, if non-designated verifiers want to verify 
the signatures they must compute Pi and ^2- But they do not hold the secret key 
Uc and ut of the designated verifiers. However, the security of finding Pi and P2 
is also based on Base problem 1 

Thus, non-designated verifiers cannot compute Pi andy^^, nor carry out the 
verification. 

> Unforgeability: Non-designated verifiers cannot forge the signatures. 
Explanation: Suppose an opponent captures the signatures (m, U], P2, ^) send 
to the designated verifier Cindy and he try to operate the forgery from the 
condition of the verification i.e. he wants to determine h Hi (H2(PiP2)®m)) 
such that the condition of verification (d x\ ~ hxo, d - h) are satisfied. But for 

obtaining h he must compute Pi (= Ucfliia'^ ) and P2 (= aja2a^^ ) that uses the 

secret key of the verifier. Hence, he cannot forge the signatures from the 
condition of verification. 

> Unlinkability: The two designated verifier do not know each other even then 
they can verify the signatures individually. 

Explanation: The two designated verifiers Cindy and Trevor do not know 
anything about each other's identity; even then they can verify the signatures 
individually. Moreover, providing Cindy P2 ( = aja2a~^) and Trevor Pi (= 
Ufjaia'^ ) with the signatures does not reveal the identity of the other designated 
verifier. 

6. Proposed Designated Verifier Proxy Signature Scheme With 
Delegation By Warrant 

In this section we propose our designated verifier proxy signature scheme. We 
have added the concept of proxy in the scheme proposed in section 4. 

• Key Generation: Same as section 3. 

• Proxy key Generation: The signer Alice chooses a message 'm', a warrant 
and a braid ZgsLBi and computes =agZ^a~^ . She sends <T= (ntw, Zo, O to 
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the proxy signer Bob. Bob checks if tox'^ If yes, then Bob computes the 

proxy key PK = a^to 

• Proxy signature generation: The proxy signer Bob chooses a braid beLBi 
and computes a = bxcb'' , /3 bx[ b'\ h ^Hj (H2(P) © m„), y = bhb'\ S = bxpb'\ 

6 = ba.p\PK)apb'\ Sends cr'= (m^, a, y, 5, 9, t^) to Cindy. 

• Proxy Signature Verification: Cindy on receiving cr' computes ^ = Ucaa^' , 
h = H](H2(fi)®m^)) and accepts the signature if and only if y-^h, S-^Xp , 
yd'^hxp, yO'^hto holds. 

• Correctness: The following relation give the correctness of the verification 
equation: 

> y^bhb-' 
i.e. y-'^h 

> d^bxpb-' 
i.e. S'^Xp 

> yd = (bhb-')(bxpb-') 

= b(hxp)b'^ 
i.e. yd'^hxp 

> yd ^(bhb-')(ba-p'(PK)apb-') 

= (bhb'^)(ba~p ( aptoU'J )apb'') 

= (bhb-')(btob-' ) 
= b(hta)b-.^ 
i.e. yO'^hto 

• Applications: 

Consider the scenario of online internet shopping where a vendor Bob is selling 
goods, produced by Alice. A customer Cindy wishes to buy any of products 'P' 
like books, music CDs and movies etc. Since Cindy does not completely trust Bob 
for his products so she needs a digitally signed receipt from Bob so that she can 
check the originality, authenticity and legality of the product 'P'. Moreover, Cindy 
also expects that the receipt should not only bounds with the identity of Bob but 
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also that of goods producer Alice. With such a receipt, Cindy will be convinced 
that goods are produced only by Alice and are being sold by Bob. At the same 
time Alice and Bob wants that validity of Cindy's receipt can only be verified by 
Cindy herself and she should not be able to illegally distribute this digitally signed 
receipt to others. In this situation, Strong Designated Verifier Proxy Signature 
Schemes can be used to produce digital receipt instead of ordinary signatures, as 
proposed here. 

• Security Analysis: In this section we discuss the security aspects of our 
scheme 

> Proxy protected: Only the proxy signer can sign the message. 
Explanation: The construction of proxy key involves the secret key of the 
proxy signer. So, no one other than the proxy signer can construct the proxy 
key. Moreover, the warrant is attached with the signature that contains the 
identity of the proxy signer. Also, the proxy key involves a secret braid chosen 
by the original signer. So, even if one knows the secret key of both the original 
signer and the proxy signer he cannot construct the valid proxy key. 

> Strongness: Only the designated verifier can check the validity of the 
signatures. 

Explanation: The verification of the designated signatures involves the secret 
key of the designated verifier. So, only the designated verifier can check the 
validity of the signatures. 

> Secrecy of the proxy key: This is same as proposed in section 3. 

7. Proposed Bi-Designated Verifier Proxy Signature Scheme With 
Delegation By Warrant 

Now, in this section we add one more designated verifier to the scheme proposed 
in section 6 to form a new concept of bi-designated verifier signature scheme over 
braid groups. 

• Key Generation: Same as section 3. 

• Proxy key Generation: The signer Alice chooses a message 'm', a warrant 
on message 'm' and a braid ZgGLBi and computes =a^z^a~^ and sends fm^. 
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Zo, to) to the proxy signer Bob. Bob checks ?o^o~ ^o. If this holds then 
computes the proxy key PK = aptga'J . 

• Signature Generation: The signer Alice chooses a message 'm' and a braid 
bGLBi and computes aj = bxj}'^, = hx^h'\ a2 = bxjb'', f}2 = bx'j.b'^ 

h = Hi(H2(Pip2)®rn„), y = bhb-\ S = bxpb'^, = ba~J (PK)apb-^ 

Sends oi = (m, ai, f}2, 7, ^, 0, m„) to the designated verifier Cindy and a2 = (m, 
Oil, y, (5, 6, Mw) as the signature on message 'w' to the designated verifier 
Trevor through a secure channel. 

• Signature Verification: Cindy on receiving the signatures computes 
Pi = acaia~\ h = Hj(H2(f^if^2)®m), and accepts the signature if and only if 
7 ~ /z, (5 ~ , 7(5 ~ hxp, yd ~ hto holds. 

Similarly, Trevor computes ^2 = aja2a^^ h = Hi(H 2(^1^2)®^)-: and accepts 
the signature if and only if y^h,S-Xp,yd- hXp, yO ~ hto holds. 

• Correctness: The following equations gives the correctness of the proposed 
scheme 

^ 7 = bhb'^ i.e. y 

^ (5 = bx^'^ i.e. d^Xp 

> yS = (bhb-^)(bxpb-^) = b(hxp)b-^ 
i.e. yd ~ hxp 

> yO =(bhb-^)(ba~p (PK)apb-^) 

= (bhb'^ )( b a~p ( Qptottp )apb'^ ) 

= (bhb'')(btob-' ) 
= b(hto)b-' 
i.e. yO^hto 

• Applications: 

A corporate manager Alice will have vacations for one or two weeks. However, in 
his absence some current business proposals need to be discussed with the clients. 
Assistant Bob, as the representative of Alice is assigned proxy signing powers to 
negotiate with a single business proposal with two different customers Cindy and 
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Trevor in this period and to sign the contract with the person who satisfies their 
conditions. During this procedure some intermediate documents will be produced 
for authentication purpose using digital signatures. To protect the confidentiality 
and authenticity of those documents it may be highly expected that the 
corresponding signatures could be validated only by the designated receiver. 
Moreover, they should not be able to convince any third party about these facts. In 
such cases, Strong Bi-Designated Verifier Proxy Signature Schemes as proposed 
in chapter 6 could be utilized. 

• Security Analysis: In this section we discuss the security aspects of our 
scheme 

> Proxy protected: Only the proxy signer can sign the message. 
Explanation: Same as the section 4 scheme. 

> Strongness: Only the two designated verifiers can check the validity of the 
signatures. 

Explanation: The verification of the designated signatures involves the secret 
key of the designated verifiers i.e. if Cindy wants to check the validity of the 
signatures then he has to use his secret key. So, only the designated verifier can 
check the validity of the signatures. 

> Secrecy of the proxy key: This is same as proposed in section 3. 
8. Conclusion 

In this paper we have proposed a proxy signature scheme with delegation by 
warrant using conjugacy search problem over the braid groups. Firstly, we have 
proposed our proxy signature scheme that includes the warrant with the signatures 
that restricts the proxy signer to create the valid proxy signatures for a certain 
period of time. We then discuss designated verifier and bi-designated verifier 
signature schemes. Finally, we added these two concepts of proxy signatures and 
designated verifier signatures and bi-designated verifier signatures. The security of 
our schemes is based on the conjugacy problem of braid groups. To the best of our 
knowledge these are first signature schemes of this type defined over braid groups. 
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